CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67353 guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

CVE-2026-67339 guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2026-67289

FreeRDP vulnerability CVE-2026-67289 affects versions up to 3.28.0. The server-controlled RDP redirection TargetNetAddress field is not validated for CRLF/control characters, causing the value to be copied into the client’s ServerHostname. When using an HTTP proxy, http_proxy_connect() writes thi...

CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67353 guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

EUVD-2026-51840

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67339

GuzzleHTTP/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers, allowing proxy credentials to be captured in origin logs during redirects or SOCKS proxy scenarios. This affects guzzlehttp/guzzle prior to 7.14.2 and can occur when...

CVE-2026-67296 FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

EUVD-2026-51864

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67314

CVE-2026-67314 affects axios versions >=1.15.2 and

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

FortiClient EMS - Authentication Bypass

Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior. id:...

CVE-2026-14840

CVE-2026-14840 concerns the YOP Poll WordPress plugin (before 7.0.6). The vulnerability arises because the plugin does not validate the connection’s origin IP and trusts client-controlled forwarding headers when enforcing per-IP vote limits, enabling unauthenticated attackers to bypass the vote r...

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Summary When prettyUrls: true is enabled on @apostrophecms/file a documented SEO feature for serving uploaded files at clean URLs, the public pretty-URL handler builds the upstream URL using the raw Host HTTP request header: js proxyUrl = $req.protocol://$req.get'host'$uglyUrl That URL is then...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

CVE-2026-62959 Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...